DPDP for professional firms

Data about people you never met, held for years

A payroll file holds data about every employee of the client. A litigation file holds data about the opposing party and witnesses. A due-diligence file holds data about a target company’s directors and staff. None of them are your clients, and none of them gave you their data.

For much of this data you act for the client and on its instructions, so you are usually its processor and the engagement letter is your contract. For some work, such as an audit opinion or legal advice, you decide how the data is used in line with your professional duties, and you are likely to be a fiduciary for that work.

Most of the Act’s duties, including notice and consent, do not apply where processing is necessary to enforce a legal right or claim (s. 17(1)(a)), though the firm still answers for the processing and must keep reasonable security safeguards. That exemption does not cover ordinary advisory or compliance work. Under legal review: The boundary of s. 17(1)(a) for different kinds of legal and advisory work should be confirmed.

Retention is where firms drift furthest. Professional bodies and tax law set minimum periods. The Act expects the rest to go once those periods end, including in archived mailboxes and former staff members’ drives. Under legal review: The retention periods set by ICAI, ICSI, the Bar Council and tax law for each kind of file should be confirmed.

Usually a processor

Payroll, bookkeeping, filings and registers maintained on the client’s instructions.

Often a fiduciary

Audit working papers, legal advice and opinions, where professional judgement decides the use.

Always yours

Your own staff, articled clerks, candidates and marketing contacts.

The three roles, in a worked case

The Act gives three roles. The Data Principal is the person the data is about. The Data Fiduciary decides why and how it is used, and carries the duties. A Data Processor handles it on the fiduciary’s behalf, under a contract. The same business can be a fiduciary for some data and a processor for other data.

The case

A chartered accountancy firm runs payroll for a manufacturing company with 300 employees. It works in cloud accounting software, keeps files on a cloud drive, and uses a freelancer for TDS returns. Separately, the firm is the statutory auditor of a different company.

When an employee asks the firm to correct their payroll record, the firm passes the request to the company, which decides. Write that route into the engagement letter.

What a professional firm holds, and where it goes

Where it comes in

Each is a point where consent may be asked for; where it is, a notice must come with it or before it (s. 5).

• Engagement onboarding and client KYC
• Documents sent by email and messaging apps
• Access to clients’ accounting, payroll and HR systems
• Government portals used on the client’s behalf
• Meetings, calls and recordings
• Recruitment of staff and articled clerks

Where it goes

Where professional firms are most exposed

Severity follows the same rules as the assessment; your own result sets it from your answers. How severity is set.

Who else handles the data

You answer for what your processors do with the data (s. 8(1)), and you need a valid contract with each (s. 8(2)). Some vendors are fiduciaries in their own right; the table says where that is common.

41 controls written for professional firms, on top of 66 common ones

Alongside the common controls, the professional services assessment asks about the client file: whether you act for the client or decide yourself, engagement letters, data you did not need, people in the file who are not your client, email and cloud drives, link sharing, freelancers and subcontractors, ethical walls between clients, client KYC, and retention by professional rules.

Each control is weighted by how critical it is and tied to the section of the Act or rule behind it. How results work.

Six of the questions you will be asked

Questions ask what you actually do, not whether you have a policy. Each answer maps to one control.

1. PRO-01 High

   For client files that contain other people's personal data, do you know whether you act for the client or decide its use yourself?

   Answers: Yes, Partly, No, Not sure · “Yes” means: Known for each type of engagement.

   Why it is asked: Where you only carry out a client's instructions, such as running its payroll, you are likely to be its Data Processor. Where your professional duties decide how the data is used, such as in an audit or legal advice, you are likely to be a Data Fiduciary yourself. The duties differ, so record which applies to each engagement.

2. PRO-02 High

   Do your engagement letters cover how client data is used, protected, kept and returned?

   Answers: Yes, Partly, No, Not sure · “Yes” means: Covered in every letter.

   Why it is asked: Where you act for the client, it must engage you under a valid contract; your letter is that contract.

3. PRO-38 High

   Do freelancers and outsourced staff work on client files inside firm systems with their own accounts, rather than downloading files to their own devices?

   Answers: Yes, Partly, No, Not sure · “Yes” means: Firm systems only.

   Why it is asked: Files on a freelancer's own device are outside your control when the work ends.

4. PRO-22 High

   Are links to client folders shared only with named people, set to expire, and reviewed so that "anyone with the link" access is removed?

   Answers: Yes, Partly, No, Not sure · “Yes” means: Named people, expiring, reviewed.

   Why it is asked: Open links to client folders are forwarded, indexed and forgotten.

5. PRO-15 Medium

   When someone in a client file asks to see, correct or delete their data, do you pass the request to the client where you act for it, and answer it yourself where you are the fiduciary?

   Answers: Yes, Partly, No, Not sure · “Yes” means: A rule covers both cases.

   Why it is asked: The fiduciary answers rights requests. Answering directly for a client can breach confidentiality; ignoring requests breaches the Act.

6. PRO-03 High

   Do you have a retention schedule that follows your professional rules, and delete files when it ends?

   Answers: Yes, Partly, No, Not sure · “Yes” means: A schedule is set and applied.

   Why it is asked: Data must be erased once its purpose ends unless another law requires keeping it. Professional rules set some of these periods.

All 41 questions written for professional firms

1. PRO-01 For client files that contain other people's personal data, do you know whether you act for the client or decide its use yourself? Organisation and role mapping
2. PRO-09 Have you identified every group whose data you hold: individual clients, clients' employees and customers in files you receive, counterparties, witnesses, your own staff and candidates? Organisation and role mapping
3. PRO-40 When you run payroll, bookkeeping, background checks or similar services, do you process the data only on the client's documented instructions and never for your own purposes? Organisation and role mapping
4. PRO-10 Do you ask clients to send only the data the engagement needs, and return or delete what arrives beyond that, such as whole employee databases? Data inventory and purpose
5. PRO-11 Do you know where old client data sits: archived mailboxes, former staff's drives, old servers and paper files in storage? Data inventory and purpose
6. PRO-12 Are individual clients (not companies) told, in the engagement letter or onboarding, what data you collect, why, and whom to contact? Notice and transparency
7. PRO-13 Are client names, contacts and engagement details used for newsletters, event invitations or case studies only with consent? Consent and lawful basis
8. PRO-14 Are CVs of unsuccessful candidates deleted after the hiring decision unless the candidate agrees to be kept for future roles? Consent and lawful basis
9. PRO-15 When someone in a client file asks to see, correct or delete their data, do you pass the request to the client where you act for it, and answer it yourself where you are the fiduciary? Data Principal rights
10. PRO-16 Is data you use for tax returns, payroll, verification reports or other work that affects individuals checked for accuracy before use? Data quality
11. PRO-17 When you file data with authorities or pass it to other professionals, are errors corrected and the correction passed on? Data quality
12. PRO-03 Do you have a retention schedule that follows your professional rules, and delete files when it ends? Retention and deletion
13. PRO-18 Are paper files shredded or destroyed by a vendor that confirms destruction in writing, rather than sold as scrap or thrown away? Retention and deletion
14. PRO-19 Are laptops, phones, external drives and multifunction printers wiped before disposal, return or repair? Retention and deletion
15. PRO-20 At the end of an engagement where you acted for the client, do you return or delete its data as the client instructs, keeping only what your professional rules require? Retention and deletion
16. PRO-41 Are client KYC documents kept securely, with access limited, for the period the applicable rules set and then deleted? Retention and deletion
17. PRO-05 Do partners and staff avoid keeping client documents on personal phones and personal WhatsApp? Security safeguards
18. PRO-07 Do you send sensitive documents through a protected link or password-protected file rather than as plain email attachments? Security safeguards
19. PRO-21 Are firm laptops encrypted, and cloud drives and backups holding client files encrypted, with identity numbers masked in working papers where possible? Security safeguards
20. PRO-22 Are links to client folders shared only with named people, set to expire, and reviewed so that "anyone with the link" access is removed? Security safeguards
21. PRO-23 Is email set up to reduce misdirected messages, for example warnings for external recipients, a short send delay and autocomplete cleared of stale addresses? Security safeguards
22. PRO-39 Is client messaging done through firm-controlled business accounts on firm devices, with documents moved to the client file and deleted from chats? Security safeguards
23. PRO-24 When a client document goes to the wrong person, is it logged and notified to the Board and the people affected, or, where you act for a client, reported to the client at once so it can notify? Breach response
24. PRO-02 Do your engagement letters cover how client data is used, protected, kept and returned? Processors and vendors
25. PRO-08 Are your email, cloud storage, practice management, accounting and payroll software providers bound by written data terms? Processors and vendors
26. PRO-25 Do your providers' terms require immediate breach notice and let you export and delete all data when you leave? Processors and vendors
27. PRO-26 Before using a new tool or provider for client data, do you check its security, storage location and access? Processors and vendors
28. PRO-06 Are article clerks, freelancers and outsourced staff bound by written confidentiality and data terms? Processors and vendors
29. PRO-38 Do freelancers and outsourced staff work on client files inside firm systems with their own accounts, rather than downloading files to their own devices? Access control
30. PRO-27 When you share client data with counsel, experts, valuers or network firms for your own decisions, is there a basis for it and is the client told? Data sharing and disclosure
31. PRO-28 Do you record which outside parties received client data, so you can answer a request about who it went to? Data sharing and disclosure
32. PRO-29 Are requests from tax authorities, police and regulators for client data checked by a partner, limited to what is required, and logged, with privilege considered? Data sharing and disclosure
33. PRO-30 Do you know where your email, cloud drives, practice management and accounting tools store data? Transfer and storage location
34. PRO-31 Where client data is worked on by offshore teams or foreign network firms, have the transfers been checked against any government restriction and agreed with clients? Transfer and storage location
35. PRO-32 Do you keep each client's data instructions, consents and closing confirmations with the engagement file? Records and evidence
36. PRO-04 Are email and document storage protected by two-step sign-in, with shared mailboxes kept to a minimum? Access control
37. PRO-33 Is access to each client's folders limited to the people working on that engagement, with walls where clients conflict? Access control
38. PRO-34 When partners, staff or articled clerks leave, are their accounts closed and mailboxes handed to a named person? Access control
39. PRO-35 Do you review who can open client folders and who has firm accounts at least twice a year? Incident testing
40. PRO-36 Is there a written policy covering client documents on personal devices, messaging, sending documents and paper files? Policy and training
41. PRO-37 Do staff, articled clerks and interns sign a confidentiality undertaking before working on client files? Policy and training

Evidence that may be asked for

A “yes” is self-declared until something shows it. These are the documents and records that usually do. Your own result lists what each control needs.

• Engagement letter template with data clauses, and a signed example
• Two-step sign-in enforcement on email and cloud drives
• Sharing settings showing links limited to named people, with expiry
• Freelancer and subcontractor agreements, and their firm accounts
• Staff and articled-clerk confidentiality undertakings
• Retention schedule following professional and tax rules
• Record of a file deleted, or returned to the client, at the end of its retention period

What makes evidence good enough · How the Evidence Room keeps it

First actions, in the order they usually make sense

1. Turn on two-step sign-in for every mailbox and cloud drive

   Now

2. Put freelancers, subcontractors and articled clerks under written terms

   Now

3. Add data clauses to engagement letters

   Before 13 May 2027

4. Move client files off personal devices and chats into firm accounts

   Before 13 May 2027

5. Close “anyone with the link” sharing and set link expiry

   Before 13 May 2027

6. Adopt a retention schedule and delete expired files, including archived mailboxes

   Before 13 May 2027

7. Review access when people join, leave or change teams

   Ongoing

Your own result orders these by your answers and the law’s dates. How to plan remediation.

The reports a professional firm usually needs

Clients ask firms how their data is handled, and a firm that advises on DPDP will be asked about its own practices.

Every report states whether the result is Self-Assessed, Evidence-Supported or Expert-Verified. None is a certificate or a statement of compliance. All six reports.